Google-spoofing worm on the loose

Warning for downloaders tempted to stray to the dark side

Downloaders looking for a free Star Wars game may instead find themselves installing a new worm that gives them dodgy Google search results.

The worm, called P2Load.A, is being spread on P2P (peer-to-peer) programs such as Shareaza and Imesh, masquerading as a free version of the Lucasfilm game Knights of the Old Republic II, said Forrest Clark, senior manager of consumer product marketing at antivirus vendor Panda Software.

P2Load.A first began proliferating on Wednesday and is most widespread in the US and Chile, Clark said.

When the software is installed, it makes changes to the computer's browser so that any user trying to access Google's search engine is instead presented with a Google lookalike page, hosted on a server in Germany.

The page appears to be a working copy of the company’s search engine and gives nearly identical search results. But the sponsored links are different, Clark said. "What they're doing is replacing all of the AdWords ads with fake ads, and they're selectively changing some of the search results," he commented.

Even users who mistype the www.google.com address are redirected to the fake site, which also supports the same range of languages as Google.com. This redirection is achieved by modifying the host file in the infected computer's operating system, which is a kind of address book used to quickly connect the browser to websites.

By changing this file the worm's authors could spoof other popular websites, and possibly modify this attack for phishing, Clark said.

The P2Load.A worm seems to have been written to make money for its authors by increasing the number of visitors directed to the sites listed in the phony ‘sponsored links’ results.

Users infected with the worm will notice one other side effect: their browser's start page will be modified to display what appears to be a shopping site.

P2Load.A affects Windows computers running either the Firefox or Internet Explorer browsers, according to Panda.